engram
Memory forensics for Windows dumps: the engram tool runs under mlab-agent in a workspace, or offline from the command line.
engram analyses Windows memory dumps. In a workspace it runs under mlab-agent on the host that holds the dumps, and your team explores the result in mlab.sh; the dump never leaves the host. It also works offline, from the command line.
Windows 10 and 11, Server 2016 to 2025, x64. Raw, crash dumps, hibernation files, LiME, AVML, ELF cores, QEMU and VMware snapshots, EWF, gzip and zip. Linux x86_64 binary.
Installation
sudo apt install engram # Debian, Ubuntu (apt.mlab.sh, see mlab-agent)
sudo dnf install engram # Fedora, RHEL, Rocky, openSUSE (pkg.mlab.sh)The binary is /usr/bin/engram-tool. Each update changes its SHA-256, which the agent policy pins: update sha256 in [tools.engram] with mlab-agent tools hash /usr/bin/engram-tool, then restart the agent.
Commands
| Command | What it does |
|---|---|
engram-tool analyze <dump> -o index.json | Analyses a dump and writes its index (.json to read, .cbor compact): processes, modules, memory map, threads, handles, network, registry, persistence, kernel state, findings. --no-environment leaves environment variables out; --no-redact keeps what looks like a secret. |
engram-tool inspect <dump> [--with-symbols] | Identifies a dump: format, kernel location, debug info, key offsets. |
engram-tool yara <dump> --index <index> --rules <rules.yar> [--pid <pid>] | Runs YARA rules over process memory. |
engram-tool reg <dump> --index <index> --hive SOFTWARE --key 'Microsoft\Windows\CurrentVersion\Run' | Reads a registry key from a hive held in memory. |
engram-tool convert <dump> -o memory.raw | Writes the dump's physical memory as a raw image, for tools that only read raw. |
engram-tool symbols pack <dumps or indexes> -o pack.zip / symbols import pack.zip --into <dir> | Symbol packs for hosts that cannot reach Microsoft's symbol server. |
engram-tool serve | Started by mlab-agent, not by hand. |
Symbols are downloaded from Microsoft's public symbol server and cached (--symbols-dir, or ENGRAM_SYMBOLS_DIR, default ./symbols). --offline never contacts the server.
Paging files
Pages Windows moved to disk are not in the dump. Copy the host's pagefile.sys and swapfile.sys next to the dump as <dump>.pagefile.sys and <dump>.swapfile.sys: engram reads them. Pages in the Windows memory compression store cannot be read yet.
Settings (agent policy)
| Key | Default | Meaning |
|---|---|---|
dump_dirs | [] | Folders whose dump files can be listed and opened (directly inside, symbolic links ignored) |
max_read_len | 65536 | Largest memory read, at most 262144 |
collect_environment | true | Environment variables in indexes |
redact_secrets | true | Mask what looks like a password, token or key in command lines and environments before the index leaves the host |
symbols_offline | false | Never contact the symbol server; use the cache only |
mlab-agent
The mlab.sh workspace agent: runs on your hosts, connects out only, and serves the tools its local policy allows.
postmortem
Offline static dependency scanner for Node.js, Python, Rust, Ruby, PHP, Go and JVM projects. Resolves the lockfile graph, walks vendored sources, and flags supply-chain compromise patterns.